daftari 1.30.0 → 1.32.0

package/dist/serve/index.js

@@ -0,0 +1,507 @@
+// `daftari serve` (#5, spec 2026-07-20) — server mode over Streamable HTTP.
+//
+// One always-on instance, many MCP clients. The mechanical core: createServer
+// already parameterizes the access context, so each MCP session gets its own
+// Server bound to the identity resolved when the session opened — no tool
+// handler changes, and every RBAC/existence-disclosure invariant applies
+// per session, transport-independently.
+//
+// Fail-loud rules (all from the spec, all startup or session-open errors,
+// never silent downgrades):
+//   - non-loopback bind requires auth configured AND
+//     server.transport_security: external declared;
+//   - a token entry whose env var is unset, or whose role is not declared,
+//     refuses to start;
+//   - once auth is configured, a missing/unmatched bearer token is rejected
+//     at session open (401) on every bind — never downgraded to guest;
+//   - the deny-all guest exists only in the no-auth loopback configuration.
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { createServer as createHttpServer, } from "node:http";
+import { resolve } from "node:path";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { GUEST_ROLE, resolveAccess } from "../access/rbac.js";
+import { ok } from "../frontmatter/types.js";
+import { installShutdownHandlers, parseFlag, startVaultServices } from "../index.js";
+import { acquireLock } from "../lifecycle/lock.js";
+import { setProvider } from "../search/vector.js";
+import { createServer, resolveToolExposure, SERVER_VERSION } from "../server.js";
+import { createBackend } from "../storage/backend.js";
+import { directoryExists } from "../storage/local.js";
+import { syncVault } from "../storage/sync.js";
+import { loadConfig } from "../utils/config.js";
+export const DEFAULT_PORT = 8787;
+export const DEFAULT_BIND = "127.0.0.1";
+const HELP = `daftari serve — server mode over Streamable HTTP (spec 2026-07-20).
+
+Usage:
+  daftari serve --vault <path> [--port <n>] [--bind <addr>] [--takeover]
+
+Defaults:
+  --port ${DEFAULT_PORT}
+  --bind ${DEFAULT_BIND}   (loopback; non-loopback binds require auth AND
+                    server.transport_security: external in config)
+
+  --takeover      deliberately replace a LIVE daftari holding this vault
+                  (a plain serve refuses against any live holder)
+
+Endpoint: http://<bind>:<port>/mcp   (MCP Streamable HTTP)
+
+Auth: clients send "Authorization: Bearer <token>". Two composable schemes:
+  server.auth.tokens — static tokens; values come from the env vars named in
+    config, never from config itself.
+  server.auth.oauth  — OAuth 2.1 resource-server validation: bearer JWTs are
+    verified against the IdP's JWKS (issuer + audience + expiry) and the
+    subject claim maps through the declared subjects table. A valid token
+    with an unmapped subject is 403 (authenticated, not authorized).
+With any auth configured, a missing/invalid credential is a 401 at session
+open — never a guest downgrade; with no auth (loopback only), sessions run
+as the deny-all guest.
+
+Exit codes: 2 config/usage error, 3 runtime error.
+`;
+const LOOPBACK_BINDS = new Set(["127.0.0.1", "::1", "localhost"]);
+export function isLoopbackBind(bind) {
+    return LOOPBACK_BINDS.has(bind);
+}
+// Pure startup gating (#5): everything that must refuse before a socket
+// opens. Exported for direct tests — the rules matter more than the wiring.
+export function validateServeStartup(config, bind, env) {
+    const authConfigured = config.server.tokens.length > 0 || config.server.oauth !== undefined;
+    if (!isLoopbackBind(bind)) {
+        if (!authConfigured) {
+            return {
+                ok: false,
+                error: `refusing to bind ${bind} with no authentication configured — ` +
+                    `declare server.auth.tokens and/or server.auth.oauth in .daftari/config.yaml`,
+            };
+        }
+        if (config.server.transportSecurity !== "external") {
+            return {
+                ok: false,
+                error: `refusing to bind ${bind}: declare server.transport_security: ` +
+                    `"external" to acknowledge that TLS terminates upstream (or the ` +
+                    `network is trusted); daftari never terminates TLS itself`,
+            };
+        }
+    }
+    const tokens = [];
+    for (const t of config.server.tokens) {
+        const value = env[t.env];
+        if (typeof value !== "string" || value.length === 0) {
+            return {
+                ok: false,
+                error: `server.auth.tokens entry for ${t.user} names env var ${t.env}, which is not set`,
+            };
+        }
+        if (!(t.role in config.roles)) {
+            return {
+                ok: false,
+                error: `server.auth.tokens entry for ${t.user} names role '${t.role}', ` +
+                    `which is not declared in config roles`,
+            };
+        }
+        tokens.push({ secret: Buffer.from(value, "utf-8"), user: t.user, roleName: t.role });
+    }
+    // OAuth (#7): the block's shape was validated at config load; startup
+    // verifies what only this process can — URL parseability and that every
+    // mapped role is declared, the same loud posture as the token entries.
+    const oauth = config.server.oauth;
+    if (oauth) {
+        for (const field of [oauth.issuer, oauth.jwksUri]) {
+            let parsed;
+            try {
+                parsed = new URL(field);
+            }
+            catch {
+                return { ok: false, error: `server.auth.oauth: '${field}' is not a valid URL` };
+            }
+            // JWKS/issuer over plaintext http would let a network-position
+            // attacker serve a forged key set and mint arbitrary authorized
+            // sessions — https only, with loopback http as the sole escape hatch
+            // (local test IdPs; no network position exists on the host itself).
+            // URL.hostname keeps IPv6 brackets ("[::1]"); strip them so the
+            // loopback set (written for bare --bind values) matches.
+            const loopbackHost = isLoopbackBind(parsed.hostname.replace(/^\[|\]$/g, ""));
+            if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopbackHost)) {
+                return {
+                    ok: false,
+                    error: `server.auth.oauth: '${field}' must use https ` +
+                        `(plain http is allowed only for loopback test IdPs)`,
+                };
+            }
+        }
+        for (const [subject, entry] of Object.entries(oauth.subjects)) {
+            if (!(entry.role in config.roles)) {
+                return {
+                    ok: false,
+                    error: `server.auth.oauth.subjects entry for ${subject} names role ` +
+                        `'${entry.role}', which is not declared in config roles`,
+                };
+            }
+        }
+    }
+    return { ok: true, tokens };
+}
+// Constant-time match of the presented bearer against every configured
+// secret. Iterates the FULL list regardless of an early match, so response
+// timing does not reveal which (or whether any) entry matched.
+export function matchToken(presented, tokens) {
+    const presentedBuf = Buffer.from(presented, "utf-8");
+    let matched = null;
+    for (const t of tokens) {
+        const sameLength = presentedBuf.length === t.secret.length;
+        // timingSafeEqual requires equal lengths; compare against self when the
+        // lengths differ so every candidate costs one comparison either way.
+        const equal = timingSafeEqual(sameLength ? presentedBuf : t.secret, t.secret);
+        if (sameLength && equal && matched === null)
+            matched = t;
+    }
+    return matched;
+}
+function bearerFrom(req) {
+    const header = req.headers.authorization;
+    if (typeof header !== "string")
+        return null;
+    const m = /^Bearer\s+(.+)$/.exec(header);
+    return m ? m[1] : null;
+}
+function writeJson(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+function readBody(req) {
+    return new Promise((resolveBody, rejectBody) => {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(c));
+        req.on("end", () => {
+            const raw = Buffer.concat(chunks).toString("utf-8");
+            if (raw.length === 0) {
+                resolveBody(undefined);
+                return;
+            }
+            try {
+                resolveBody(JSON.parse(raw));
+            }
+            catch (e) {
+                rejectBody(e);
+            }
+        });
+        req.on("error", rejectBody);
+    });
+}
+export function makeLoopbackGuard(port) {
+    const spellings = ["127.0.0.1", "localhost", "[::1]"];
+    return {
+        hosts: new Set(spellings.map((h) => `${h}:${port}`)),
+        origins: new Set(spellings.map((h) => `http://${h}:${port}`)),
+    };
+}
+export function violatesLoopbackGuard(guard, host, origin) {
+    if (!host || !guard.hosts.has(host)) {
+        return `Host header '${host ?? "<missing>"}' is not a loopback address for this server`;
+    }
+    if (origin !== undefined && !guard.origins.has(origin)) {
+        return `Origin '${origin}' is not allowed on a loopback bind`;
+    }
+    return null;
+}
+export function startHttpServer(vaultRoot, config, tokens, bind, port) {
+    const sessions = new Map();
+    const oauth = config.server.oauth;
+    const authConfigured = tokens.length > 0 || oauth !== undefined;
+    // JWKS key set, created lazily on the first OAuth verification: jose
+    // caches fetched keys, so the server stays stateless and offline-tolerant
+    // after the first fetch (spec Decision 2, phase 2).
+    let jwks = null;
+    // Set once the listener is up (the ephemeral-port case needs the BOUND
+    // port); no request can arrive before listen resolves.
+    let loopbackGuard = null;
+    // Resolves the request's identity under the spec's session rules, or
+    // writes the rejection and returns null. With auth configured:
+    //   - a static-token match binds its declared identity;
+    //   - else, with oauth declared, a bearer that verifies against the IdP's
+    //     JWKS (issuer + audience + signature + expiry) maps its subject claim
+    //     through the declared table — a valid-but-unmapped subject is 403
+    //     (authenticated, not authorized), NEVER guest;
+    //   - anything else is 401. With no auth at all (startup gating
+    //     guarantees loopback) every session is the deny-all guest.
+    const authenticate = async (req, res) => {
+        if (!authConfigured) {
+            return resolveAccess(config, "guest", GUEST_ROLE);
+        }
+        const presented = bearerFrom(req);
+        if (presented !== null) {
+            const matched = matchToken(presented, tokens);
+            if (matched !== null) {
+                return resolveAccess(config, matched.user, matched.roleName);
+            }
+            if (oauth) {
+                try {
+                    jwks ??= createRemoteJWKSet(new URL(oauth.jwksUri));
+                    const verified = await jwtVerify(presented, jwks, {
+                        issuer: oauth.issuer,
+                        audience: oauth.audience,
+                    });
+                    const subject = verified.payload.sub;
+                    // Own-property lookup only: `subjects` is a plain object, and a
+                    // sub claim like "constructor" or "toString" would otherwise hit
+                    // an inherited Object.prototype member and skip the 403.
+                    const mapped = subject !== undefined && Object.hasOwn(oauth.subjects, subject)
+                        ? oauth.subjects[subject]
+                        : undefined;
+                    if (mapped === undefined) {
+                        writeJson(res, 403, {
+                            error: "forbidden",
+                            message: "authenticated subject has no declared role mapping",
+                        });
+                        return null;
+                    }
+                    return resolveAccess(config, mapped.user, mapped.role);
+                }
+                catch {
+                    // Signature/issuer/audience/expiry failure — an invalid
+                    // credential, not an unmapped one: 401 below.
+                }
+            }
+        }
+        writeJson(res, 401, {
+            error: "unauthorized",
+            message: "a valid bearer token is required",
+        });
+        return null;
+    };
+    const httpServer = createHttpServer((req, res) => {
+        void handle(req, res).catch((e) => {
+            const reason = e instanceof Error ? e.message : String(e);
+            if (!res.headersSent) {
+                writeJson(res, 500, { error: "internal", message: reason });
+            }
+            else {
+                res.end();
+            }
+        });
+    });
+    async function handle(req, res) {
+        // Rebinding guard runs FIRST — before routing, before auth — so no
+        // response (including 404s and 401 bodies) reaches a rebinded page.
+        if (loopbackGuard) {
+            const originHeader = req.headers.origin;
+            const violation = violatesLoopbackGuard(loopbackGuard, req.headers.host, typeof originHeader === "string" ? originHeader : undefined);
+            if (violation !== null) {
+                writeJson(res, 403, { error: "forbidden", message: violation });
+                return;
+            }
+        }
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        if (url.pathname !== "/mcp") {
+            writeJson(res, 404, { error: "not_found" });
+            return;
+        }
+        const access = await authenticate(req, res);
+        if (access === null)
+            return;
+        const sessionId = req.headers["mcp-session-id"];
+        const existing = typeof sessionId === "string" ? sessions.get(sessionId) : undefined;
+        if (existing) {
+            // A session id is routing state, not a credential: the request's own
+            // bearer must resolve to the identity the session was opened with.
+            if (existing.user !== access.user) {
+                writeJson(res, 401, {
+                    error: "unauthorized",
+                    message: "credential does not match the session's identity",
+                });
+                return;
+            }
+            const body = req.method === "POST" ? await readBody(req) : undefined;
+            await existing.transport.handleRequest(req, res, body);
+            return;
+        }
+        if (req.method !== "POST") {
+            writeJson(res, 400, { error: "bad_request", message: "unknown or missing session" });
+            return;
+        }
+        const body = await readBody(req);
+        if (!isInitializeRequest(body)) {
+            writeJson(res, 400, {
+                error: "bad_request",
+                message: "expected an initialize request to open a session",
+            });
+            return;
+        }
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (id) => {
+                sessions.set(id, { transport, user: access.user });
+            },
+            onsessionclosed: (id) => {
+                sessions.delete(id);
+            },
+        });
+        transport.onclose = () => {
+            const id = transport.sessionId;
+            if (id)
+                sessions.delete(id);
+        };
+        // One Server per session, bound to the session's identity — the whole
+        // point of Decision 2.
+        const server = createServer(vaultRoot, access, config.tools);
+        await server.connect(transport);
+        await transport.handleRequest(req, res, body);
+    }
+    return new Promise((resolveStart, rejectStart) => {
+        httpServer.once("error", rejectStart);
+        httpServer.listen(port, bind, () => {
+            httpServer.removeListener("error", rejectStart);
+            const address = httpServer.address();
+            const boundPort = typeof address === "object" && address !== null ? address.port : port;
+            if (isLoopbackBind(bind))
+                loopbackGuard = makeLoopbackGuard(boundPort);
+            resolveStart({
+                port: boundPort,
+                close: async () => {
+                    // Sessions close concurrently — shutdown latency must not scale
+                    // with the number of live clients.
+                    await Promise.all([...sessions.values()].map((s) => s.transport.close().catch(() => { })));
+                    sessions.clear();
+                    await new Promise((r) => httpServer.close(() => r()));
+                },
+            });
+        });
+    });
+}
+// Startup gate for periodic storage sync (#6): when the config declares a
+// sync cadence, the backend must be creatable BEFORE the server binds — a
+// missing SDK or bad endpoint refuses at startup instead of leaving a
+// healthy-looking server that silently never syncs. ok(null) when no
+// periodic sync is configured.
+export async function prepareStorageSync(config) {
+    const storage = config.storage;
+    if (storage?.syncIntervalMinutes === undefined)
+        return ok(null);
+    return createBackend(storage);
+}
+// The periodic push itself (#6): overlap-guarded (a slow push skips ticks
+// rather than stacking), failures logged and never fatal — the backing is a
+// durability channel, not a serving dependency. The timer is unref'd so it
+// never keeps a dying process alive. Returns a stopper. `syncFn` is
+// injectable for tests.
+export function startPeriodicSync(vaultRoot, backend, intervalMinutes, syncFn = syncVault) {
+    let syncing = false;
+    const timer = setInterval(() => {
+        if (syncing)
+            return;
+        syncing = true;
+        void syncFn(vaultRoot, backend)
+            .then((r) => {
+            if (!r.ok) {
+                process.stderr.write(`daftari: warning: storage sync failed: ${r.error.message}\n`);
+            }
+        })
+            .finally(() => {
+            syncing = false;
+        });
+    }, intervalMinutes * 60 * 1000);
+    timer.unref();
+    return () => clearInterval(timer);
+}
+export async function runServe(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    const vaultArg = parseFlag(argv, "vault");
+    if (!vaultArg) {
+        process.stderr.write("daftari serve: missing required --vault <path> argument\n");
+        return 2;
+    }
+    const vaultRoot = resolve(vaultArg);
+    if (!(await directoryExists(vaultRoot))) {
+        process.stderr.write(`daftari serve: vault directory not found: ${vaultRoot}\n`);
+        return 2;
+    }
+    const bind = parseFlag(argv, "bind") ?? DEFAULT_BIND;
+    const portRaw = parseFlag(argv, "port");
+    const port = portRaw === null ? DEFAULT_PORT : Number.parseInt(portRaw, 10);
+    if (Number.isNaN(port) || port < 0 || port > 65535) {
+        process.stderr.write(`daftari serve: invalid --port '${portRaw}'\n`);
+        return 2;
+    }
+    const config = loadConfig(vaultRoot);
+    if (!config.ok) {
+        process.stderr.write(`daftari serve: ${config.error.message}\n`);
+        return 2;
+    }
+    const gate = validateServeStartup(config.value, bind, process.env);
+    if (!gate.ok) {
+        process.stderr.write(`daftari serve: ${gate.error}\n`);
+        return 2;
+    }
+    // Storage backing for periodic sync (#6): created and validated BEFORE the
+    // lock and the listener. A config-declared capability that cannot run must
+    // refuse at startup — returning an exit code after the listener is up
+    // would leave a healthy-looking server that silently never syncs.
+    const syncBackend = await prepareStorageSync(config.value);
+    if (!syncBackend.ok) {
+        process.stderr.write(`daftari serve: ${syncBackend.error.message}\n`);
+        return 2;
+    }
+    const lock = await acquireLock(vaultRoot, SERVER_VERSION, {
+        mode: "serve",
+        bind: `${bind}:${port}`,
+        takeover: argv.includes("--takeover"),
+    });
+    if (!lock.ok) {
+        process.stderr.write(`daftari serve: ${lock.error.message}\n`);
+        return 2;
+    }
+    // Install immediately after the lock lands (the stdio path's guarantee):
+    // a failure between here and the listener opening must still release the
+    // lock on exit. `handle` is assigned once the listener is up.
+    let handle = null;
+    installShutdownHandlers(vaultRoot, () => {
+        if (handle)
+            void handle.close();
+    });
+    try {
+        setProvider(config.value.embeddingProvider);
+    }
+    catch (e) {
+        process.stderr.write(`daftari serve: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 3;
+    }
+    // Startup warnings mirror stdio's: unknown tool names in the tools block.
+    for (const name of resolveToolExposure(config.value.tools).unknown) {
+        process.stderr.write(`daftari: warning: tools.include/exclude names unknown tool '${name}' — ignored\n`);
+    }
+    try {
+        handle = await startHttpServer(vaultRoot, config.value, gate.tokens, bind, port);
+    }
+    catch (e) {
+        process.stderr.write(`daftari serve: failed to bind ${bind}:${port}: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 3;
+    }
+    const authParts = [
+        ...(gate.tokens.length > 0 ? [`${gate.tokens.length} token(s)`] : []),
+        ...(config.value.server.oauth !== undefined ? ["oauth"] : []),
+    ];
+    process.stderr.write(`daftari: serving vault at ${vaultRoot} — http://${bind}:${handle.port}/mcp ` +
+        `(${authParts.length > 0 ? authParts.join(" + ") : "no auth: guest-only"})\n`);
+    await startVaultServices(vaultRoot, {
+        warmEmbeddings: config.value.warmEmbeddings,
+        watch: config.value.watch,
+    });
+    // Periodic push to the storage backing (#6). The backend was created and
+    // validated BEFORE the listener opened (prepareStorageSync); from here on
+    // sync failures are logged, never fatal — the backing is a durability
+    // channel, not a serving dependency. Overlap-guarded: a slow push skips
+    // ticks rather than stacking.
+    const intervalMinutes = config.value.storage?.syncIntervalMinutes;
+    if (syncBackend.value !== null && intervalMinutes !== undefined) {
+        startPeriodicSync(vaultRoot, syncBackend.value, intervalMinutes);
+        process.stderr.write(`daftari: syncing to ${syncBackend.value.id} every ${intervalMinutes}m\n`);
+    }
+    return 0;
+}
+//# sourceMappingURL=index.js.map

package/dist/serve/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serve/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,wCAAwC;AACxC,EAAE;AACF,0EAA0E;AAC1E,4BAA4B;AAC5B,qDAAqD;AACrD,oDAAoD;AACpD,2EAA2E;AAC3E,wBAAwB;AACxB,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,YAAY,IAAI,gBAAgB,GAGjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAsB,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,aAAa,EAAuB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAsB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC,MAAM,IAAI,GAAG;;;;;;WAMF,YAAY;WACZ,YAAY;;;;;;;;;;;;;;;;;;;;CAoBtB,CAAC;AAUF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,IAAY,EACZ,GAAsB;IAEtB,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,oBAAoB,IAAI,uCAAuC;oBAC/D,6EAA6E;aAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YACnD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,oBAAoB,IAAI,uCAAuC;oBAC/D,iEAAiE;oBACjE,0DAA0D;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,gCAAgC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,GAAG,oBAAoB;aACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,gCAAgC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,KAAK;oBACjE,uCAAuC;aAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,KAAK,sBAAsB,EAAE,CAAC;YAClF,CAAC;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,yDAAyD;YACzD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,EAAE,CAAC;gBACnF,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,uBAAuB,KAAK,mBAAmB;wBAC/C,qDAAqD;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,wCAAwC,OAAO,cAAc;wBAC7D,IAAI,KAAK,CAAC,IAAI,0CAA0C;iBAC3D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,uEAAuE;AACvE,2EAA2E;AAC3E,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,MAAuB;IACnE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9E,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACnE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,WAAW,CAAC,SAAS,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,UAAU,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AA8BD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,IAAwB,EACxB,MAA0B;IAE1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,gBAAgB,IAAI,IAAI,WAAW,6CAA6C,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,OAAO,WAAW,MAAM,qCAAqC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,MAAqB,EACrB,MAAuB,EACvB,IAAY,EACZ,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC;IAChE,qEAAqE;IACrE,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,IAAI,GAAiD,IAAI,CAAC;IAC9D,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,aAAa,GAAyB,IAAI,CAAC;IAE/C,qEAAqE;IACrE,+DAA+D;IAC/D,wDAAwD;IACxD,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,YAAY,GAAG,KAAK,EACxB,GAAoB,EACpB,GAAmB,EACY,EAAE;QACjC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE;wBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB,CAAC,CAAC;oBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;oBACrC,gEAAgE;oBAChE,iEAAiE;oBACjE,yDAAyD;oBACzD,MAAM,MAAM,GACV,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAC7D,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACzB,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;4BAClB,KAAK,EAAE,WAAW;4BAClB,OAAO,EAAE,oDAAoD;yBAC9D,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzD,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;oBACxD,8CAA8C;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACxC,MAAM,SAAS,GAAG,qBAAqB,CACrC,aAAa,EACb,GAAG,CAAC,OAAO,CAAC,IAAI,EAChB,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;YACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAE5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAErF,IAAI,QAAQ,EAAE,CAAC;YACb,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;oBAClB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,kDAAkD;iBAC5D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,MAAM,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE;gBACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,CAAC;SACF,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE;gBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QAC/C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACtC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACjC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,IAAI,cAAc,CAAC,IAAI,CAAC;gBAAE,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACvE,YAAY,CAAC;gBACX,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,gEAAgE;oBAChE,mCAAmC;oBACnC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1F,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9D,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AACrE,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,mBAAmB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,oEAAoE;AACpE,wBAAwB;AACxB,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,OAAuB,EACvB,eAAuB,EACvB,SAA2B,SAAS;IAEpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,WAAW,CACvB,GAAG,EAAE;QACH,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;aAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACtF,CAAC;QACH,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC,EACD,eAAe,GAAG,EAAE,GAAG,IAAI,CAC5B,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,SAAS,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC;IACrD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,OAAO,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,WAAW,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,cAAc,EAAE;QACxD,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE;QACtC,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,IAAI,eAAe,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACjG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,SAAS,aAAa,IAAI,IAAI,MAAM,CAAC,IAAI,OAAO;QAC3E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAChF,CAAC;IAEF,MAAM,kBAAkB,CAAC,SAAS,EAAE;QAClC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;QAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,8BAA8B;IAC9B,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAClE,IAAI,WAAW,CAAC,KAAK,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAChE,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,WAAW,CAAC,KAAK,CAAC,EAAE,UAAU,eAAe,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server.d.ts

@@ -1,6 +1,15 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { type AccessContext } from "./access/rbac.js";
+import type { ToolsConfig } from "./utils/config.js";
 export declare const SERVER_NAME = "daftari";
 export declare const SERVER_VERSION: string;
-export declare function createServer(vaultRoot: string, access?: AccessContext): Server;
+export declare function registeredToolNames(): string[];
+export declare const CORE_TOOLS: readonly string[];
+export declare const STANDARD_TOOLS: readonly string[];
+export interface ToolExposure {
+    exposed: Set<string>;
+    unknown: string[];
+}
+export declare function resolveToolExposure(tools: ToolsConfig): ToolExposure;
+export declare function createServer(vaultRoot: string, access?: AccessContext, toolsConfig?: ToolsConfig): Server;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,kBAAkB,CAAC;AAWnE,eAAO,MAAM,WAAW,YAAY,CAAC;AAQrC,eAAO,MAAM,cAAc,QAAmB,CAAC;AAK/C,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,GAAE,aAA6B,GAAG,MAAM,CAiE7F"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,kBAAkB,CAAC;AAcnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,eAAO,MAAM,WAAW,YAAY,CAAC;AAQrC,eAAO,MAAM,cAAc,QAAmB,CAAC;AAoB/C,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAWD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAOvC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAc3C,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAIrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAKD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAoBpE;AAQD,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,aAA6B,EACrC,WAAW,CAAC,EAAE,WAAW,GACxB,MAAM,CAwDR"}